# US 12,120,148 B1 · Intelligent anti-phishing management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,148 B1 - Document ID: US12120148B1 - Status: Granted - Kind: B1 - Application number: 18/736,505 - Filed: 2024-06-06 - Granted: 2024-10-15 - Earliest claimed: 2023-05-26 - Assignees: Copperfasten Technologies Limited - Applicants: Copperfasten Technologies Limited - Inventors: Sean Morris; Neil Farrell - Web page: https://patentgrep.com/patent/US12120148B1 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are disclosed for monitoring, evaluating protection against, improving protection against, and simulating phishing threats. Network usage information for users of an organization can be leveraged to determine user-specific network behavior information. This user-specific network behavior information can then be leveraged to better identify incoming threats as well as generate and deploy user-specific phishing lures. Phishing simulation campaigns can be conducted, including by implementing variations in how the phishing lures are presented. Such campaigns can be scored to determine how different presentation variations perform. User-specific phishing lures can be generated using user environment information collected by an agent running on the user's device. Alerts informing users of potential threats can be dynamically updated with different presentation parameters to improve performance. Digital communications identified as threats can be used to generate hashes to speedily identify subsequent digital communications that are threats. ## Claims ### Claim 1 A computer-implemented method comprising: receiving user environment information, the user environment information collected by an agent running on a user device being used by a user, the user environment information including information about the computing environment of the user device; analyzing the user environment information to identify digital communication review times associated with how long the user reviews digital communications prior to acting on the digital communications; selecting an asset of a set of assets based at least in part on the digital communication review times; generating a user-specific phishing lure based at least in part on the selected asset such that the user-specific phishing lure appears to originate from the selected asset; and deploying the user-specific phishing lure such that the user-specific phishing lure is presented on the user device. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: determining a target timing based on the user environment information, wherein deploying the user-specific phishing lure is based at least in part on the target timing, and wherein the target timing is determined as a time or time range in which: (i) the user is expected to use the user device; (ii) a legitimate digital communication is expected to be received by the user; or (iii) both (i) and (ii). ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: identifying a digital communication based at least in part on the user environment information, the digital communication being associated with at least one asset of the set of assets, wherein the generating the user-specific phishing lure is further based at least in part on the identified digital communication. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the generating the user-specific phishing lure occurs in response to the identifying of the digital communication. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising analyzing the user environment information to identify a current interaction between the user and the selected asset, wherein the deploying the user-specific phishing lure occurs in response to the identifying of the current interaction. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, wherein the current interaction between the user and the selected asset includes an outgoing communication from the user to the selected asset. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein the identifying the current interaction includes identifying an action taken based at least in part on the outgoing communication, and wherein the generating the user-specific phishing lure is further based at least in part on the identified action taken. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the user-specific phishing lure includes reference to the identified action taken. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving additional user environment information, the additional user environment information collected by an additional agent running on an additional user device associated with the user, the additional user environment information including information about the computing environment of the additional user device, wherein the selecting the asset of the set of assets is further based at least in part on the additional user environment information. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the user is associated with an organization, the method further comprising: receiving additional user environment information, the additional user environment information collected by an additional agent running on an additional user device associated with an additional user, the additional user being associated with the organization, the additional user environment information including information about the computing environment of the additional user device, wherein the selecting the asset of the set of assets is further based at least in part on the additional user environment information. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving network usage information associated with the user; and determining user-specific network behavior information based on the network usage information, wherein the selecting the asset, the generating the user-specific phishing lure, the deploying the user-specific phishing lure, or any combination thereof is further based at least in part on the user-specific network behavior information. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, further comprising: determining a target timing based on the user-specific network behavior information, wherein the deploying the user-specific phishing lure is based at least in part on the target timing, and wherein the target timing is determined as a time or time range in which: (i) the user is expected to use the user device; (ii) a legitimate digital communication is expected to be received by the user; or (iii) both (i) and (ii). ### Claim 13 A system comprising: a control system including one or more processors; and a memory having stored thereon machine readable instructions, which when executed by at least one of the one or more processors of the control system, cause the system to perform operations including: receiving user environment information, the user environment information collected by an agent running on a user device being used by a user, the user environment information including information about the computing environment of the user device; analyzing the user environment information to identify digital communication review times associated with how long the user reviews digital communications prior to acting on the digital communications; selecting an asset of a set of assets based at least in part on the digital communication review times; generating a user-specific phishing lure based at least in part on the selected asset such that the user-specific phishing lure appears to originate from the selected asset; and deploying the user-specific phishing lure such that the user-specific phishing lure is presented on the user device. ### Claim 14 (depends on 13) The system of claim 13, wherein the operations further include: determining a target timing based on the user environment information, wherein deploying the user-specific phishing lure is based at least in part on the target timing, and wherein the target timing is determined as a time or time range in which: (i) the user is expected to use the user device; (ii) a legitimate digital communication is expected to be received by the user; or (iii) both (i) and (ii). ### Claim 15 (depends on 13) The system of claim 13, wherein the operations further include identifying a digital communication based at least in part on the user environment information, the digital communication being associated with at least one asset of the set of assets, wherein the generating the user-specific phishing lure is further based at least in part on the identified digital communication. ### Claim 16 (depends on 15) The system of claim 15, wherein the generating the user-specific phishing lure occurs in response to the identifying of the digital communication. ### Claim 17 (depends on 13) The system of claim 13, wherein the operations further include analyzing the user environment information to identify a current interaction between the user and the selected asset, wherein the deploying the user-specific phishing lure occurs in response to the identifying of the current interaction. ### Claim 18 (depends on 17) The system of claim 17, wherein the current interaction between the user and the selected asset includes an outgoing communication from the user to the selected asset. ### Claim 19 (depends on 18) The system of claim 18, wherein the identifying the current interaction includes identifying an action taken based at least in part on the outgoing communication, and wherein the generating the user-specific phishing lure is further based at least in part on the identified action taken. ### Claim 20 (depends on 19) The system of claim 19, wherein the user-specific phishing lure includes reference to the identified action taken. ### Claim 21 (depends on 13) The system of claim 13, wherein the operations further include: receiving additional user environment information, the additional user environment information collected by an additional agent running on an additional user device associated with the user, the additional user environment information including information about the computing environment of the additional user device, wherein the selecting the asset of the set of assets is further based at least in part on the additional user environment information. ### Claim 22 (depends on 13) The system of claim 13, wherein the user is associated with an organization, the method wherein the operations further include: receiving additional user environment information, the additional user environment information collected by an additional agent running on an additional user device associated with an additional user, the additional user associated with the organization, the additional user environment information including information about the computing environment of the additional user device, wherein the selecting the asset of the set of assets is further based at least in part on the additional user environment information. ### Claim 23 (depends on 13) The system of claim 13, wherein the operations further include: receiving network usage information associated with the user; and determining user-specific network behavior information based on the network usage information, wherein the selecting the asset, the generating the user-specific phishing lure, the deploying the user-specific phishing lure, or any combination thereof is further based at least in part on the user-specific network behavior information. ### Claim 24 (depends on 23) The system of claim 23, wherein the operations further include: determining a target timing based on the user-specific network behavior information, wherein the deploying the user-specific phishing lure is based at least in part on the target timing, and wherein the target timing is determined as a time or time range in which: (i) the user is expected to use the user device; (ii) a legitimate digital communication is expected to be received by the user; or (iii) both (i) and (ii). ### Claim 25 A computer program product, embodied on a non-transitory computer readable medium, comprising instructions which, when executed by a computer, cause the computer to perform operations including: receiving user environment information, the user environment information collected by an agent running on a user device being used by a user, the user environment information including information about the computing environment of the user device; analyzing the user environment information to identify digital communication review times associated with how long the user reviews digital communications prior to acting on the digital communications; selecting an asset of a set of assets based at least in part on the digital communication review times; generating a user-specific phishing lure based at least in part on the selected asset such that the user-specific phishing lure appears to originate from the selected asset; and deploying the user-specific phishing lure such that the user-specific phishing lure is presented on the user device. ### Claim 26 (depends on 25) The computer program product of claim 25, wherein the operations further include: determining a target timing based on the user environment information, wherein deploying the user-specific phishing lure is based at least in part on the target timing, and wherein the target timing is determined as a time or time range in which: (i) the user is expected to use the user device; (ii) a legitimate digital communication is expected to be received by the user; or (iii) both (i) and (ii). ### Claim 27 (depends on 25) The computer program product of claim 25, wherein the operations further include identifying a digital communication based at least in part on the user environment information, the digital communication being associated with at least one asset of the set of assets, wherein the generating the user-specific phishing lure is further based at least in part on the identified digital communication. ### Claim 28 (depends on 27) The computer program product of claim 27, wherein the generating the user-specific phishing lure occurs in response to the identifying of the digital communication. ### Claim 29 (depends on 25) The computer program product of claim 25, wherein the operations further include analyzing the user environment information to identify a current interaction between the user and the asset, wherein the deploying the user-specific phishing lure occurs in response to the identifying of the current interaction. ### Claim 30 (depends on 29) The computer program product of claim 29, wherein the current interaction between the user and the selected asset of the set of assets includes an outgoing communication from the user to the selected asset. ### Claim 31 (depends on 30) The computer program product of claim 30, wherein the identifying the current interaction includes identifying an action taken based at least in part on the outgoing communication, and wherein the generating the user-specific phishing lure is further based at least in part on the identified action taken. ### Claim 32 (depends on 31) The computer program product of claim 31, wherein the user-specific phishing lure includes reference to the identified action taken. ### Claim 33 (depends on 25) The computer program product of claim 25, wherein the operations further include: receiving additional user environment information, the additional user environment information collected by an additional agent running on an additional user device associated with the user, the additional user environment information including information about the computing environment of the additional user device, wherein the selecting the asset of the set of assets is further based at least in part on the additional user environment information. ### Claim 34 (depends on 25) The computer program product of claim 25, wherein the user is associated with an organization, the method wherein the operations further include: receiving additional user environment information, the additional user environment information collected by an additional agent running on an additional user device associated with an additional user, the additional user associated with the organization, the additional user environment information including information about the computing environment of the additional user device, wherein the selecting the asset of the set of assets is further based at least in part on the additional user environment information. ### Claim 35 (depends on 25) The computer program product of claim 25, wherein the operations further include: receiving network usage information associated with the user; and determining user-specific network behavior information based on the network usage information, wherein the selecting the asset, the generating the user-specific phishing lure, the deploying the user-specific phishing lure, or any combination thereof is further based at least in part on the user-specific network behavior information. ### Claim 36 (depends on 35) The computer program product of claim 35, wherein the operations further include: determining a target timing based on the user-specific network behavior information, wherein deploying the user-specific phishing lure is based at least in part on the target timing, and wherein the target timing is determined as a time or time range in which: (i) the user is expected to use the user device; (ii) a legitimate digital communication is expected to be received by the user; or (iii) both (i) and (ii).